This Privacy Policy (the "Policy") governs the manner in which the ExpressCertificate.com or “We” on this ExpressCertificate.com “Platform” collects, uses, maintains and discloses information of its users.

Last Updated: Nov 12, 2025

1. Introduction

Welcome to ExpressCertificate.com ("we," "our," "us"). We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services to generate, verify, or manage digital certificates.

By using ExpressCertificate.com, you consent to the data practices described in this policy. If you do not agree with the terms, please do not access the site.

2. Laws We Comply With: Our data collection and processing practices are designed to be consistent with the principles of the following data protection and information technology laws: Kenya: The Data Protection Act, 2019, Uganda: The Data Protection and Privacy Act, 2019, Tanzania: The Cybercrimes Act, 2015, and the guidelines from the Personal Data Protection Commission. India: The Information Technology Act, 2000, and the associated Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011.

3. Information We Collect

We collect information that you provide directly to us and information about your use of our services.

A. Personal Information:
a. This is information that can be used to identify you. We may collect:

b. Identity Data: Full name, government-issued identification number (e.g., National ID, Passport), signature.

c. Contact Data: Email address & phone number.

d. Certificate Data: Information to be included on your digital certificate (e.g., course completion details, award titles, issue dates).

e. Technical and Usage Data: IP address, browser type, device information, pages visited, and time spent on our site.

f. Financial Data: Billing address, payment card details (processed securely by our third-party payment processors).

B. Sensitive Personal Information:
The data used to generate your certificate may be considered sensitive. We process this data only with your explicit consent and for the sole purpose of providing the service you have requested.

4. How We Use Your Information

We use the information we collect for the following purposes:

a. To Provide Our Services: To create, manage, verify, and authenticate your digital certificates.

b. To Process Transactions: To manage your payments and orders.

c. To Communicate with You: To send you service-related notices, updates, security alerts, and support messages.

d. To Improve Our Services: To analyze usage trends and improve the functionality and user experience of our website.

e. To Ensure Security: To monitor and prevent fraud, abuse, and security breaches.

f. To Comply with Legal Obligations: As required by applicable laws, regulations, or legal processes.

5. Legal Basis for Processing (as per applicable laws)

We process your personal data on one or more of the following legal bases:

a. Your Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g., creating a certificate).

b. Performance of a Contract: The processing is necessary for the performance of the service agreement with you.

c. Legal Obligation: The processing is necessary for compliance with a legal obligation to which we are subject.

d. Legitimate Interests: The processing is necessary for our legitimate business interests, such as improving our services and security, provided your interests and fundamental rights do not override those interests.

6. How We Share and Disclose Your Information:

a. We do not sell your personal data. We may share your information in the following situations:

b. With Your Consent: We will share information with third parties when you have given us explicit consent to do so.

c. Service Providers: We share data with trusted third-party vendors who assist us in operating our website, conducting our business, or servicing you (e.g., cloud hosting, payment processing, customer support), under strict data processing agreements.

d. For Legal Reasons: We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

e. Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred.

7. International Data Transfers

Your personal data may be processed on servers located outside of Kenya, Uganda, Tanzania, or India. When we transfer your data across borders, we will take all reasonable steps to ensure that it is treated securely and in accordance with this Privacy Policy and the applicable data protection laws. This may include using standard contractual clauses approved by relevant authorities or ensuring the recipient country has an adequate level of data protection.

8. Data Security

We implement appropriate technical and organizational security measures designed to protect your personal data from accidental loss, unauthorized access, alteration, or disclosure. These measures include encryption, access controls, and secure server infrastructure. However, no internet transmission is completely secure, and we cannot guarantee the absolute security of your data.

9. Data Retention

We will retain your personal data only for as long as is necessary to fulfill the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. The retention period for certificate data may be long-term to facilitate future verification. You may request the deletion of your account data, subject to our legal obligations to retain certain information.

10. Your Data Protection Rights:

a. Depending on your location, you have rights under applicable data protection laws. These may include:

b. Right of Access: The right to request copies of the personal data we hold about you.

c. Right to Rectification: The right to correct any inaccurate or incomplete personal data.

d. Right to Erasure (Right to be Forgotten): The right to request that we delete your personal data, under certain conditions.

e. Right to Restrict Processing: The right to request that we suspend the processing of your personal data.

f. Right to Data Portability: The right to receive your personal data in a structured, machine-readable format.

g. Right to Object: The right to object to our processing of your personal data.

h. Right to Withdraw Consent: Where we rely on your consent, you have the right to withdraw it at any time.

i. To exercise any of these rights, please contact us using the details provided in Section 12.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our service.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at:Email: care@expresscertificate.com]

13. Changes to This Privacy Policy: We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.